The Contract Says 2019. The File Disagrees.

Why a Digital Document Can’t Fully Hide Its Own History

A paper document only shows what’s on the page. A digital one carries a second record most people never think to look at — created automatically by the software that produced it, without the author’s involvement or awareness. This is the foundation of PDF metadata examination in Kenya: comparing what a document claims about itself against what the file format was actually built to record.

This matters because the most common way a fabricated document gets caught isn’t a spelling mistake or an inconsistent signature — it’s a mismatch between the story the document tells and the story its own file structure tells. Three sources carry most of that story: PDF properties, Word’s internal revision data, and EXIF metadata in photographed signature pages.

PDF Properties: What the Document Information Dictionary Reveals

Open the properties panel of almost any PDF and you’ll find a small set of fields most people ignore: Author, Producer, CreationDate, ModDate, and often the specific software version used to generate it. These fields are written automatically at the moment of export or save — a contract “created” using a version of Adobe Acrobat or Microsoft Word that didn’t exist yet at the claimed contract date is, on its own, close to conclusive.

Beyond the visible properties panel, many PDFs also carry XMP metadata — a more detailed, XML-based record embedded in the file that can include edit history, prior filenames, and the specific application and operating system used at each save. Where a PDF has gone through multiple saves or exports, XMP metadata can preserve a trail of those events even after the visible properties panel has been manually edited to show something else.

Word Revision History: What Survives “Accept All Changes”

A .docx file is not a single block of text — it’s a ZIP archive containing multiple XML files that separately describe the document’s content, formatting, comments, and revision data. Clicking “Accept All Changes” removes the visible track-changes markup from the reading view, but it doesn’t always purge every trace of that history from the underlying file structure, especially where a document has been saved rather than freshly exported as a clean copy.

Examiners look specifically at the document’s internal author list — every account name that has ever edited the file, in what’s sometimes a longer list than the document’s visible signatories would suggest — alongside embedded save timestamps and, in some cases, remnants of deleted comments or prior paragraph versions. A contract whose internal author history includes a name entirely unconnected to either party, or whose earliest recorded edit postdates the agreement’s claimed signing date, raises exactly the kind of question a court or opposing counsel needs answered.

EXIF Data: When the “Original Signed Copy” Is Just a Photo

An enormous number of disputed agreements in Kenya don’t arrive as clean PDFs at all — they arrive as a photograph of a signed page, taken on a phone and sent over WhatsApp or email. That photograph carries its own metadata, called EXIF (Exchangeable Image File Format) data, which can include the exact date and time the photo was taken, the camera or phone model used, and — where location services were enabled — GPS coordinates for where the photo was captured.

This becomes significant when a photographed “original” signature page is claimed to have been signed at one time and place, but its EXIF capture timestamp — or the compression pattern typical of a specific messaging app’s re-encoding — tells a different story. Even where an image has been forwarded and re-compressed multiple times, forensic examination can often still establish the file lineage and, where original EXIF data survives, the true capture window.

Backdated Contracts: Reading the Three Sources Together

The strongest findings rarely rest on a single metadata field — they come from cross-referencing all three sources against each other and against any independent record available, such as email transmission logs, printer spool history, or a notary’s own diary. A contract that is internally consistent across PDF properties, Word revision history, and any accompanying photographed signature page is far harder to challenge than one relying on a single date claim alone. Conversely, even one clear contradiction — a creation date, an author name, or a capture timestamp that doesn’t fit the claimed story — is often enough to shift an entire dispute.

Forged Agreements: Where Metadata Meets Physical Examination

Many forged agreements aren’t created from scratch — they’re built by editing a genuine older document (reusing its letterhead, formatting, and reference numbers) and re-exporting it as a new PDF. This is precisely why PDF metadata examination is treated as a companion discipline to physical document examination rather than a replacement for it: the metadata reveals when and how the digital file was produced, while ink, paper, and signature analysis address the physical instrument if a hard copy also exists. Where both are available, cross-referencing digital and physical findings produces the most defensible conclusion — which is why UFC treats PDF metadata examination as a direct extension of its Forensic Document Examination practice, not a separate service.

Frequently Asked Questions